NIST SP 800-172

NIST Special Publication 800-172 is a set of 35 enhanced security requirements developed by the National Institute of Standards and Technology to protect Controlled Unclassified Information (CUI) in nonfederal systems that are associated with critical programs or high value assets. It supplements the baseline requirements in NIST SP 800-171 and is designed for environments where advanced persistent threats, including nation-state adversaries, represent a realistic and ongoing risk.

What is NIST SP 800-172?

NIST SP 800-172 was published under the authority of the Federal Information Security Modernization Act (FISMA) and the policy guidance of OMB Circular A-130. The requirements are organized under the same 14 security control families as SP 800-171, covering areas such as access control, configuration management, incident response, risk assessment, and system and communications protection. However, the enhanced requirements go significantly further, introducing controls such as penetration-resistant architectures, cyber deception technologies, and more rigorous monitoring and response obligations.

The primary regulatory hook for contractors is DFARS clause 252.204-7012, which mandates SP 800-171 compliance for all contractors handling CUI on behalf of DoD. SP 800-172 is not automatically required by that clause. Instead, it is invoked by specific contract-level requirements when the DoD contracting officer determines that the information involved or the program's strategic importance warrants an enhanced security posture. SP 800-172 also forms the technical basis for CMMC Level 3, which the DoD is implementing for its highest-priority acquisitions.

Why it matters for contractors

Contractors pursuing high-value defense contracts, particularly those involving weapons systems development, hypersonic technologies, space programs, or critical national security infrastructure, should expect SP 800-172 compliance requirements to appear in solicitations. Because the requirements exceed the SP 800-171 baseline substantially, contractors cannot achieve compliance through a simple incremental upgrade. Implementing penetration-resistant architectures and deception technologies requires dedicated engineering effort, specialized expertise, and potentially significant capital investment.

Contractors who build SP 800-172 compliance into their infrastructure ahead of solicitation requirements will have a meaningful competitive advantage. Those who wait until award risk contract delays and compliance findings that jeopardize performance.

Example

A defense prime contractor is awarded a contract to develop components for a next-generation hypersonic vehicle program. The contracting officer includes a clause invoking SP 800-172 because the program is designated a high value asset subject to nation-state targeting. The contractor must implement all 35 enhanced requirements on top of its existing SP 800-171 baseline. This includes deploying cyber deception tools on its development network, redesigning its remote access architecture to be penetration-resistant, and establishing advanced threat hunting procedures. The contractor documents its compliance posture in a System Security Plan addendum and submits it to the government for review before beginning sensitive program work.